Eir D1000 Wireless Router - WAN Side Remote Command Injection (Metasploit)

=begin Exploit Title: Eir D1000 Wireless Router - WAN Side Remote Command Injection Date: 7th November 2016 Exploit Author: Kenzo Website: https://devicereversing.wordpress.com Tested on Firmware version: 2.00AADU.520150909 Type: Webapps Platform: Hardware Description =========== By sending certa...

Imperva 11.5 Detection Bypass

Bypass Imperva by confusing HTTP Pollution Normalization Engine Author: Wiswat Aswamenakul Environment: Tested with Imperva Version: 11.5 and Web Backend as IIS + ASP Description: One of technique that attackers use to bypass web application firewall is to use HTTP pollution attack. The attack ca...

EVORIM Free Firewall 1.3.2 Privlege Escalation

Exploit Title: EVORIM Free Firewall Unquoted Service Path Privilege Escalation Date: 30/10/2016 Author: Ashiyane Digital Security Team Vendor Homepage:http://www.evorim.com Software Link: http://www.evorim.com/download/freefirewall-x32-setup.exe version : 1.3.2 Latest Tested on: Windows 7 EVORIM...

RHEL 7 : firewalld (RHSA-2016:2597)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2597 advisory. firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. The following packages have been upgrade...

Moderate: Red Hat Security Advisory: firewalld security, bug fix, and enhancement update

An update for firewalld is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

firewalld: Firewall configuration can be modified by any logged in user

A flaw was found in the way firewalld allowed certain firewall configurations to be modified by unauthenticated users. Any locally logged in user could use this flaw to tamper or change firewall settings...

Cold Disk Quick Response: CDQR

Cold Disk Quick Response tool The CDQR tool uses Plaso to parse disk images with specific parsers and create easy to analyze custom reports. The parsers were chosen based on my experience and triaging best practices and the custom reports group like items together to make analysis easier. The...

Mitigations Available for PanelShock Vulnerabilities in Schneider HMIs

One week after addressing a critical vulnerability in its industrial controller management software, Schneider Electric is in the midst of handling two more serious flaws in a number of its Magelis HMI products. HMI is short for human machine interface, a graphical visualization of an industrial...

SSH Brute Force Logins With Default Credentials Reporting

It was possible to login into the remote SSH server using default credentials. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Industrial firewall and an accident! Schneider industrial firewall is explosion serious security vulnerability-vulnerability warning-the black bar safety net

According to the foreign media to the latest reports, industrial security firm CyberX security research experts at 2 0 1 6 years of industrial control systems ICS Network Security Conference disclosed several serious security vulnerabilities, including the one present in the Schneider industrial...

Insecure Browser API Token Generation

The Palo Alto Networks firewalls API browser does not properly use the REST API tokens. In a specific scenario, an attacker could steal the authentication token and perform calls to the firewall’s API. Ref PAN-61046/100428...

CVE-2016-6432

A vulnerability in the Identity Firewall feature of Cisco ASA Software before 9.62.1 could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. An attacker could...

CVE-2016-6431

A vulnerability in the local Certificate Authority CA feature of Cisco ASA Software before 9.61.5 could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of crafted packets during the enrollment operation. An attacker...

Design/Logic Flaw

A vulnerability in the local Certificate Authority CA feature of Cisco ASA Software before 9.61.5 could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of crafted packets during the enrollment operation. An attacker...

CVE-2016-6431

A vulnerability in the local Certificate Authority CA feature of Cisco ASA Software before 9.61.5 could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of crafted packets during the enrollment operation. An attacker...

Windows Atom Tables Can Be Abused for Code Injection Attacks

Researchers have identified a way attackers could use atom tables in all versions of Windows to inject malicious code into a computer and bypass detection by security products at the same time. The technique has been nicknamed AtomBombing by researchers at enSilo, and opens the door to perform...

To [Hell] Shell and Back

My initial thought was it has to be the firewall keeping my reverse shell from getting out of their environment. So, leveraging the command execution vulnerability, I started testing outbound internet access from the vulnerable server to my server on the internet, only to find that the port I had...

Topsec Firewall Cookie Command Injection (ELIGIBLECANDIDATE)

Binary data topseceligiblecandidate.nbin...

Orange Inventel LiveBox 5.08.3-sp - Cross-Site Request Forgery

Exploit Title: Orange Inventel LiveBox CSRF Google Dork: N/A Date: 10-24-2016 Exploit Author: BlackMamba TEAM BM1 Vendor Homepage: N/A Version: Inventel - v5.08.3-sp Tested on: Windows 7 64bit CVE : N/A Category: Hardware 1. Description This Router is vulnerable to Cross Site Request Forgery , a...

Palo Alto Networks PAN-OS Information Disclosure Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. Palo Alto Networks PAN-OS has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...